Switches, Hubs, and Modems
1748280 Members
3904 Online
108761 Solutions
New Discussion юеВ

Identifying the source of a broadcast storm

 
OLARU Dan
Trusted Contributor

Re: Identifying the source of a broadcast storm

Neil_77
Frequent Advisor

Re: Identifying the source of a broadcast storm

Thanks, Dan, that does indeed look like a useful tool!
seymour999
Frequent Advisor

Re: Identifying the source of a broadcast storm

Solarwinds switch port mapper is indeed a useful tool.

If you want an ongoing record of MAC-port assignments and changes, you can also use Kiwi CatTools. Schedule it to harvest MAC address-port assignments more often than the switch's MAC address aging time (which you've no doubt increased from the default 5 min). CatTools also reports the dates when it first and last saw each MAC address.

Collecting the router's ARP table at the same time allows building a spreadsheet relating IP address, DNS name and MAC address of all attached devices.

As you're probably aware, Ghost also has a unicast mode. Depending on what you're trying to achieve (and your network configuration) that will put less stress on the network.

Hope this is useful.
Evan
seymour999
Frequent Advisor

Re: Identifying the source of a broadcast storm

Solarwinds switch port mapper is indeed a useful tool.

If you want an ongoing record of MAC-port assignments and changes, you can also use Kiwi CatTools. Schedule it to harvest MAC address-port assignments more often than the switch's MAC address aging time. CatTools also reports the dates when it first and last saw each MAC address.

Collecting the router's ARP table at the same time allows building a spreadsheet relating IP address, DNS name and MAC address of all attached devices.

As you're probably aware, Ghost also has a unicast mode. Depending on what you're trying to achieve (and your network configuration) that will put less stress on the network.

Hope this is useful.
Evan
Tombo
New Member

Re: Identifying the source of a broadcast storm

Hi Neil.
I have had this exact same problem occur recently. Just wondering if you found a simple way of resolving it. In particular the error you described.
(If I look in the switch event logs, I can also see a number of messages stating "ip: Invalid ARP Source: w.x.y.z on w.x.y.z" where w.x.y.z is the address of the particular switch itself. There are multiple messages of this sort, aswell as the occasional "ip: Invalid ARP Target: 0.0.0.0 on w.x.y.z").
Also here is an ok link for mrtg http://people.ee.ethz.ch/~oetiker/webtools/mrtg/mrtg-nt-guide.html
Zundapp
New Member

Re: Identifying the source of a broadcast storm

Neil,
I am undergoing the same problems and can't seem to find the culprit either.
Keep us posted as I will on any new findings or methods of troubleshooting these issues.
I don't know what is meant by multicast ghost? I also have the IGMP multicast filtering on my 8/4000/2400 series swithches enabled however I don't know if that's as efficient as IGMP snooping (if this may be a multicast issue). I talk of a well populated controls network in which we are using ethernetIP, which is a multicast protocol as well.